How do you handle errors and return meaningful error responses in a REST API?

Expected Interview Answer

Step-by-Step Explanation

1. Step 1

   Choose the right status code

   Map failures accurately: 400/422 for bad input, 401/403 for auth, 404 for missing, 409 for conflict, 5xx for server faults.

2. Step 2

   Define a consistent error shape

   Adopt a standard body such as RFC 7807 Problem Details with type, title, status, detail, and a stable error code.

3. Step 3

   Centralise handling

   Catch errors in one middleware or handler so every response has the same format and codes.

4. Step 4

   Log with correlation IDs

   Record the full error server-side with a request/trace ID that also appears in the client response for support.

5. Step 5

   Sanitise for production

   Never expose stack traces or internal messages; return safe, generic detail for unexpected 5xx errors.

Code Example

class ApiError extends Error {
  constructor(status, code, detail, errors) {
    super(detail)
    this.status = status
    this.code = code
    this.errors = errors
  }
}

// Route throws a typed error
app.post('/api/users', (req, res, next) => {
  if (!req.body.email) {
    return next(new ApiError(422, 'VALIDATION_ERROR', 'Request validation failed', [
      { field: 'email', message: 'email is required' },
    ]))
  }
  // ...
})

// Central handler (registered last)
app.use((err, req, res, next) => {
  const status = err.status || 500
  const traceId = req.id
  if (status >= 500) logger.error({ err, traceId })

  res.status(status).json({
    type: `https://api.example.com/errors/${err.code || 'INTERNAL'}`,
    title: status >= 500 ? 'Internal Server Error' : err.message,
    status,
    code: err.code || 'INTERNAL',
    detail: status >= 500 ? 'An unexpected error occurred' : err.message,
    errors: err.errors,
    traceId,
  })
})

Follow-up Questions

• What is the RFC 7807 Problem Details format?
• When would you use 422 instead of 400?
• How do you avoid leaking sensitive information in error responses?
• Why include a correlation or trace ID in errors?
• How do you handle validation errors with multiple fields?